Claude Skills by fabioc-aloha

Calibrated human-AI collaboration with creative latitude — trust calibrated to reliability, creativity preserved with validation.

Proactive detection, self-correction, and epistemic vigilance

Domain-agnostic knowledge acquisition — from zero to structured expertise through conversational learning

Record confidence claims and reconcile against outcomes — closing Tenet V (calibration over confidence)

Challenge what you think is right — alternative hypotheses, missing data, evidence quality, bias detection, falsifiability, and adversarial review

Systematic problem-solving and error analysis.

CSAR Loop and structured conversation patterns for effective AI dialog -- Clarify, Summarize, Act, Reflect

Investigate build failures, test errors, runtime crashes, or unexpected behavior through systematic minimal reproduction, multi-hypothesis testing, and evidence-based verification. Use when asked to \"debug\", \"investigate a failure\", \"find root cause\", \"troubleshoot\", \"fix a failing test\", or \"diagnose an issue\". Always re-run builds and tests after changes.

Cross-project pattern recognition — abstract, generalize, connect, store at the highest true level

Step-back protocol — restate, generalise, specialise, invert, ask why, pre-mortem, check stakeholders, and audit framings before solving

Find the true source, not symptoms — systematic debugging from observation to permanent fix

Be a thinking partner. The answer often emerges when explaining the problem.

Help users discover answers, don't just deliver them.

Validate input against an allowlist of permitted values — reject everything else

API security hardening — rate limiting, JWT validation, CORS, input validation (4-layer defense)

Generate assisted PRs to correct Security Group ownership for first-party apps flagged by S360 tenant-isolation policy (SFI-TI3.2.2)

Fix compile-time and build errors introduced by prior agent changes

Creates a new Network Security Group and associates it with the specified subnets and/or NICs of a Virtual Network.

Defense-in-depth, PII protection, secrets scanning, and secure packaging for distributed software

Raw error messages leak internal information to users:

Query S360 Kusto for SFI-TI3.2.2 tenant isolation violations, classify by ViolationTitle, flag autofix-eligible items for downstream remediation

Generate an interactive, self-contained HTML dashboard displaying SFI-TI3.2.2 tenant isolation violations for a service, org, or alias -- includes filtering, sorting, severity coding, TSG links, S360 deep links.

Complex multi-step remediation scenarios for S360 Tenant Isolation violations that require code changes, Federated Identity Credential (FIC) setup, and bilateral coordination between service teams.

End-to-end process of rehoming (moving or reissuing) certificates so every production Entra app credential lives in the same tenant and cloud as the app itself.

Extract and resolve required CodeQL alert metadata from user input before remediation

Checks every subnet in a Virtual Network for an associated Network Security Group, and also inspects each NIC attached to those subnets for NIC-level NSG coverage.

Finds the Network Interface Card (NIC) and associated Network Security Group (NSG) for a VM given its public IP address.

Markdown sanitization order matters — marked.js then DOMPurify then Mermaid to prevent XSS

Cleans up NNF deployments impacted by vulnerable or outdated container images using guided execution.

Produce the final CodeQL fix result table and choose the correct exit code and retry behavior

When copying files or serving content, user-controlled paths can escape the intended directory:

Handling personally identifiable information under European and Australian privacy regulations.

Privacy by design, data protection, and responsible AI principles.

Applies M365NetIsoNsg compliance rules to an existing Azure NSG and outputs the ARM template for Safe Deployment.

Skill helps user to remove checked-in certificates from source code in case of exposed secrets

Skill helps user to revoke and rotate certificate in case of exposed secrets

Secure token storage, VS Code SecretStorage API, credential management, environment variable migration

Defend before attackers find the gaps - OWASP, STRIDE, and Microsoft SFI

Analyze codebase architecture to generate a STRIDE-based threat model with data flow diagrams, trust boundaries, prioritized threats, and mitigations. Compatible with Microsoft Threat Modeling Tool concepts. Use when asked to \"threat model\", \"security analysis\", \"STRIDE analysis\", \"identify security threats\", \"data flow security\", \"generate a threat model\", or \"security architecture review\".

Use execFileSync with args array instead of execSync with string concatenation to prevent shell injection

Classify and remediate CodeQL alerts with the SymFix workflow using staged changelog updates

Discover a codebase's threat surface through systematic investigation — map ecosystem groups, dependency graphs, service connections, authentication mechanisms, and trust boundaries. Use when performing threat modeling, security review, or architectural analysis of any multi-ecosystem repository.

Orchestrate end-to-end SFI-TI3.2.2 workflow — fetch violations, classify, dispatch to remediation skills, generate report

Detect coherence violations between Alex_ACT_Edition (brain) and Alex_Skill_Mall (marketplace) — broken references, tag mismatches, deprecated install snippets

Keep heir projects synchronized with Master Alex brain updates — audit drift, upgrade brains, verify deployments

Curate Alex_Skill_Mall — decide when to add, keep, refresh, or prune stores and catalog entries

Effective patterns for on-call shift transitions, ensuring continuity, context transfer, and reliable incident response across shifts.

Complete release automation for VS Code Marketplace publishing

Cut a release of Alex_ACT_Edition — preflight, brain-qa, changelog, version bump, tag, push

Review submissions to Alex_ACT_Edition for ACT spec compliance, content quality, and scope fit